Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
14/09/2024, 04:44
Static task
static1
Behavioral task
behavioral1
Sample
df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe
-
Size
706KB
-
MD5
df830eb5080f62a3db751c9d52ba8988
-
SHA1
35d9240031ad0d1a854ad66990779bd6fc7fb956
-
SHA256
ffccc382e7d1a080e8f88ac14465ca35ea9c6d4eda84d5c0d87553efd4a527ec
-
SHA512
8c634f34184ab0c27e9f0d94d529e8e116916714b4213c499af482169198f855d49d3827ae9a29a5c64b8b36bfd2f9a7337ad55dd258a6365ac8b57e04927589
-
SSDEEP
12288:gp/iN/mlVdtvrYeyZJf7kPK+iqBZn+D73iKHeGspjf1UZImVU2YFox9we2a:gpQ/6trYlvYPK+lqD73TeGspaZDW2WGL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1808 ScrBlaze.scr -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\s18273659 df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe File created C:\Windows\ScrBlaze.scr df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe File created C:\Windows\s18273659 ScrBlaze.scr File opened for modification C:\Windows\s18273659 ScrBlaze.scr File created C:\Windows\s18273659 df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ScrBlaze.scr -
Modifies Control Panel 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\ScrBlaze.scr" df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main ScrBlaze.scr Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch ScrBlaze.scr Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" ScrBlaze.scr Key created \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2736 df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe 2736 df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe 1808 ScrBlaze.scr 1808 ScrBlaze.scr -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2736 wrote to memory of 1808 2736 df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe 31 PID 2736 wrote to memory of 1808 2736 df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe 31 PID 2736 wrote to memory of 1808 2736 df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe 31 PID 2736 wrote to memory of 1808 2736 df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\df830eb5080f62a3db751c9d52ba8988_JaffaCakes118.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\ScrBlaze.scr"C:\Windows\ScrBlaze.scr" /S2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
854B
MD5e935bc5762068caf3e24a2683b1b8a88
SHA182b70eb774c0756837fe8d7acbfeec05ecbf5463
SHA256a8accfcfeb51bd73df23b91f4d89ff1a9eb7438ef5b12e8afda1a6ff1769e89d
SHA512bed4f6f5357b37662623f1f8afed1a3ebf3810630b2206a0292052a2e754af9dcfe34ee15c289e3d797a8f33330e47c14cbefbc702f74028557ace29bf855f9e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5d5e7550f47e036389490aeeb91a2132b
SHA15559c30fe9bd507c52ee8a00cbba5e8db1506cb5
SHA25684c968fc04baf4262fdb9bdd2ae818d73beafe0d38e69fc907b36e9202e0e336
SHA5120775787e2d2512954617945a5a6a242539802014b3abde175cc38bf6e42cbf716dd58ecdb9200a4e247cacd625d9b4fe9cc1cc5128988f4ada4bd869152e8653
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174
Filesize471B
MD5889dd76ae1cf8142dd6fa0951da93b92
SHA12cd978d0dac080b2dafcb1a4844f89df2d62d4af
SHA2565f93b38339fd55325d70308316707c849f7200784871dfc03628327bdaee1812
SHA5124b8dc9e4b7d141708f4203deec7f2f3cc2caeb4508433a79d90a77f80f021a4087eb041ee1672333ea8f36209d48914962848deed7d6091b3402bc6abb281d8e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_2F09F384AB04F931E2EF39FD04145E2F
Filesize471B
MD5848b5613282a5db0192b8598bc70578b
SHA1dcc3a332827e1f0c902770051e36bcd1afc67ae3
SHA256211d5b4509af876058debf19795fdc7588cf349a9fc81f28ab9ec4bb833b0e60
SHA512049fd7f830345212ac8fda2b1b30721bcf0496a397fb6ab6b1a185694fa04e0cf0957b814b956334ab1491bd1c5884656bba1c4e78fb97297fbd18905fbb65d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199
Filesize170B
MD5ebda9d4e41e3f490b595b22e7c91ba37
SHA12b68a2de03e13c4ef4a2a3ef4cfb78861d75284f
SHA2561a73d7c3ce91edebb26df07e9015f912b16b92ad107a99d3891a9c089823b986
SHA512b834a56ee71ddf35d9d23c923fc97ea8bfa19028e76ab6e0a8e73b904942a836bfe5cba57d3b4f51ccde9a74c84ada64d3a52cfd79ef5a804088139b0bc5ad7c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5731ca0f66982354c1c4035936bd76217
SHA1b92d9bb293c74f0289ab2b086c1827642cfdc348
SHA2564cd2fdb591d5adc8706d9b092790eb76bd72c4a2c6cd160d0d780aecc41bdb4b
SHA51254987962d56bc7460df986519dc4b97693afd448618dff64c618885013eced4b4d99f82d33ef37a57194227b112f86e3373655e025b78be87ad25a301f2ab503
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_2E1554F9937BF8D3743D83D919742174
Filesize406B
MD54b6ef7f155438e741e95126c0c54f329
SHA17c49adb503690fdc98e7f0be40fd6758cad2b47d
SHA2565666991071c6f457c8d686a7a776f008a4fdfbf8bb2228e9fc9f36c19581e3d7
SHA5127c53eeaf11aa300efd9053f1bbaa22f2f3b4e722b5dd4a43f4c1e0121baf24871da37c2073041a4285968b0718a54341724199989f22a1a28a491af2ed50092b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5538ddd99a2f2606e8f36b325a31bcfa6
SHA187ddce361bcefdd96aec09da4adc3f58657406e4
SHA256bc629438f8c5df7591516c4ccfcac0b1c2dc493b58a16d501f949457cda6637d
SHA51272d42cc6692122581e29125a6a69715a625c2117c1de0ca45284002b03916f55bda1b212e5fafabda1cba616a9acd293b6f05bc915d50d0f407aab8e3dd3382c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_2F09F384AB04F931E2EF39FD04145E2F
Filesize410B
MD50f300292747a6890e2a44e4beb6893e1
SHA1f231365ad213ed3b470cae372e3293621a6994b4
SHA256d11a480c72e92379872ec5fc33876045f8155089b1bd965ce8f46d7f5e8fcfcf
SHA5124c003fe6855fdabc8404159e49f59e066b1f11362ede547b04039a927ff547d846b2fd7810ba35676b2a2b517e37b78c1345120ed4ff60534c76a2e94b7106fb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH\css[1].css
Filesize312B
MD52494130e2dd81fb40051261cac87fa92
SHA108bf1ea9863ee62a66bf9a75161176caa5a11cec
SHA256ad6e8562d7a6a701d734b60795921409d5449b1806b88ffb1173e832c6da695b
SHA5125defafa591cbe2fce7b02dbde7b9ff834fb0e5a3da41807978560c292aad11546045f8689d7de4d583c1635012bbcda48b8f49bf0588abe8ef50480fbb2f7134
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\4RXRX1VH\firefox[1].png
Filesize9KB
MD57f980569ce347d0d4b8c669944946846
SHA180a8187549645547b407f81e468d4db0b6635266
SHA25639f9942adc112194b8ae13ba1088794b6cb6e83bd05a4ed8ce87b53155d0e2f7
SHA51217993496f11678c9680978c969accfa33b6ae650ba2b2c3327c45435d187b74e736e1489f625adf7255441baa61b65af2b5640417b38eefd541abff598b793c9
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\edgium[1].png
Filesize6KB
MD501010c21bdf1fc1d7f859071c4227529
SHA1cd297bf459f24e417a7bf07800d6cf0e41dd36bc
SHA2566fb31acdaf443a97183562571d52ce47dd44c1a8dcb4087338d77ea2617b286e
SHA5128418d5ac3987ee8b6a7491167b0f90d0742e09f12fceb1e305923e60c78628d494fcd0fee64f8a6b5f6884796360e1e3ec1459dc754bbfb874504f9db5b56135
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\yt_logo_rgb_light[1].png
Filesize8KB
MD5d654f892f287a28026cd4d4df56c29c8
SHA198779a55fe32a66ebec8338c838395d265e45013
SHA256fc6f5d8f32f13d5855840234dc1bff5c91c35318ee2192d99b13eb3572f0bca8
SHA5123668902aeaf792ad73ba51e0a4caaa520ebc38177791dfac9a9b28026c3bde99e721bf54d626f266a19cfd045a6d2dc8c8e70e53a2c5ee524c6f2736bb0ce409
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\chrome[1].png
Filesize6KB
MD5ac10b50494982bc75d03bd2d94e382f6
SHA16c10df97f511816243ba82265c1e345fe40b95e6
SHA256846a9b551e74f824fd7ace3439a319b0c0803449e8caec9f16e2666e38a80efd
SHA512b6666b540aef6c9c221fe6da29f3e0d897929f7b6612c27630be4a33ae2f5d593bc7c1ee44166ce9f08c72e8608f57d66dd5763b17fec7c1fb92fc4d5c6dd278
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J7FHNNOW\dinosaur[1].png
Filesize57KB
MD5bdda3ffd41c3527ad053e4afb8cd9e1e
SHA10ad1bb7ce8d8a4dc8ac2a28e1c5155980edfab9b
SHA2561a9251dc3b3c064cfc5e2b90b6c7dc3c225f7017066db2b77e49dae90a94a399
SHA5124dc21ef447b54d0e17ccd88db5597171047112ce1f3f228527e6df079ce2a43a463a3a1e4255828b12f802d70a68dbe40b791852134be71c74de97718b2f1d5f
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\css[1].css
Filesize181B
MD5f407e7b6e7d9fc9da41d84c225ba6dbf
SHA12c26b50f87ee2e0d8c2f345106047e2055a147a7
SHA256df378280434faf25fbbdaf52d145580a12fffdaa2fe3f45f7e24d4cf8f7a13af
SHA512cc6ff71ed48e437215cd54ab4b527f01935070aeed4e6650c27c0d304eb80b3e7207c859425bd0f770c091c968e45e704c25bec0009dcb5b513823956f7e8528
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\opera[1].png
Filesize2KB
MD55cb98952519cb0dd822d622dbecaef70
SHA12849670ba8c4e2130d906a94875b3f99c57d78e1
SHA25602f95fbdb68f232bffd4f2c0fdd033d6c83b829c610cddccc0b1d43e2274e6a7
SHA5125f29b7459fbd01e16dbd196e4bcddf109af017cccf31337abe1cec6cc5a84711fc2cd34ad7a35d9432a9d7e42ca23d7f6c9d4315396429d7b8e48b9491696afc
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
74B
MD59c0d9148bb3f1fe41726e7a8011595cd
SHA1bb8928ffb26b52985ad74173b1bf41c0464adcf2
SHA256c08e5c39ac11032f0dd43c47083540d061aaf9dbce72cbf4cfb980f6b99c5cdd
SHA512d496f1f89e7d9846589157730c6044d2de91a72c8888522d91bdc9f01a068c24282eb55e7105b2cffa4dc3bf5a1d2da4d56134610b709ff204145e7be4912fae
-
Filesize
706KB
MD5df830eb5080f62a3db751c9d52ba8988
SHA135d9240031ad0d1a854ad66990779bd6fc7fb956
SHA256ffccc382e7d1a080e8f88ac14465ca35ea9c6d4eda84d5c0d87553efd4a527ec
SHA5128c634f34184ab0c27e9f0d94d529e8e116916714b4213c499af482169198f855d49d3827ae9a29a5c64b8b36bfd2f9a7337ad55dd258a6365ac8b57e04927589
-
Filesize
894B
MD5db43454a4afc3fe19ce08128f50cda36
SHA1ce582c545bca29c5e5b3065874e43dab451342e5
SHA256d458868aece535f351ca78c089aca07302eae7953fcf9d1b7dba02c1cb382d35
SHA512ce395ceb101b4f08e2accd41943e61bbdc671b5d45e2167bf31aff1ad657b385c0cf4b438a159fd70572a161aa7fc0c64b52f68fd57a69a2d0fb96fc4f64dc9b
-
Filesize
964B
MD5445a4389c2bd0bfffb96d8c0d2a087b6
SHA1329520e0e8c9365d1ce6f6488dfa0771aa6f5c27
SHA256b870e7d52db9615de3eb8b9a94ae7c33896c57c42f8d382da14a091c103d4567
SHA512b71471dfeca9e5e0ed5f7ae166568729a8a6f61796721be7ea399ee59f0a6f5fd64639f0ca8d55228f50cfac17943b246c55eed5651da33f089a62a5a3bbeb7c